CVE-2026-6094
Undergoing Analysis Undergoing Analysis - In Progress
Heap Buffer Overread in wolfSSL PKCS7 Parser

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: wolfSSL Inc.

Description
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-26
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-6094
EUVD
EUVD-2026-39480
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfssl *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

Immediate mitigation involves updating wolfSSL to a version that includes the fix for this vulnerability.

According to Resource 1, the issue was addressed in a pull request merged on April 23, 2026, which added bounds checking and NULL pointer checks to prevent the vulnerability.

Therefore, applying the patch from PR #10128 or upgrading to a wolfSSL version that contains this fix is recommended.

Executive Summary

This vulnerability is a heap buffer overread occurring in the function wc_PKCS7_DecodeEnvelopedData when it parses specially crafted PKCS7 EnvelopedData. An attacker could exploit this by supplying malicious data, potentially delivered via S/MIME or CMS, causing the program to read beyond the allocated memory buffer.

Impact Analysis

The heap buffer overread could lead to information disclosure or cause the application to crash. Since the vulnerability can be triggered by attacker-supplied data without requiring user interaction or privileges, it poses a risk of unauthorized data exposure or denial of service.

Detection Guidance

This vulnerability involves a heap buffer overread in the wc_PKCS7_DecodeEnvelopedData function when parsing crafted PKCS7 EnvelopedData, potentially triggered by attacker-supplied data via S/MIME or CMS.

Detection would likely involve monitoring or analyzing S/MIME or CMS messages for malformed or crafted PKCS7 EnvelopedData that could trigger the vulnerability.

No specific detection commands or tools are provided in the available resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart